Analyze like a CTI team
Six threat analysis scenarios: EDR timeline, malware configuration, exploitation logs, IOC feeds, attribution and forecasting. You analyze the evidence, answer at each step and get a detailed correction.
Multi-source IOC correlation
The SIEM raises 2,300 “IOC” alerts overnight. Separate noise from signal: threat feed false positives, a DNS beacon, a PowerShell execution and a MISP match.
Analyzing a targeted intrusion
A defense subcontractor detects a suspicious network beacon. From the EDR timeline, rebuild the attack chain, map it to MITRE ATT&CK and assess what can (and cannot) be said about the attacker.
Infostealer campaign through malvertising
Three workstations downloaded a trapped “7-Zip installer”. Analyze the sandbox report, cluster the samples, pivot on the infrastructure and choose the right response measures.
Forecasting the threat to a hospital group
Management wants to know “what to expect in the next six months”. Analyze an initial access listing on a forum, leak site trends and your exposure, then produce an actionable strategic assessment.
Zero-day on a VPN gateway
A vendor publishes a critical advisory for its VPN gateway, with no patch. Your logs show exploitation predating the advisory. Analyze, prioritize and produce an alert for your sector.
Attributing an attack on a power grid
A power grid operator suffers an outage caused by industrial malware, followed by the wiping of its servers. Assess capabilities, intent, context and technical overlaps, then write a careful attribution.
Organizations, domains and indicators are fictional. Techniques, tools and references (MITRE ATT&CK, TLP, estimative language) are real.
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.